Ukraine Air Alert App Apparently Hacked, Sends False Radiation Alert
Users of Ukraine's air raid app received false radiation and chemical threat alerts for Kyiv on Sunday. Hours later Russia said its own app had been attacked.
Ukraine's air raid alert app sent false warnings on Sunday night, including a radiation threat for Kyiv. Officials say it was apparently hacked, and Russia reported a similar incident hours later.
Timing against a Kherson truce
The false alerts came minutes before a local ceasefire in the Kherson region ended at 23:00 on Sunday. The truce, in place since the previous Tuesday, was meant to let civilians leave the Russian-occupied city of Oleshky. Fighting went on elsewhere.
Sequence of the false alerts
At about 22:47 the app showed red-level air raid alerts for what looked like the whole country, plus extra warnings for Kyiv. The first said a radiation threat was declared in the capital.
A message in Russian followed a minute later, announcing a nuclear alert and saying an Oreshnik was flying. Chemical-attack and street-fighting warnings for Kyiv arrived at 22:49, each telling people to stay indoors.
The all clear came at 23:53 as separate messages, one per Kyiv alert. That is more than an hour after the first warning.
Reaction from officials
Svitlana Onyshchuk, governor of Ivano-Frankivsk Oblast, said "Everything is calm in the region for now." Her region had a red-level air raid alert from 22:50 to 23:57.
In Vinnytsia, regional head Natalya Zabolotna described a cyber-attack on the app. She told residents to avoid the link in the message, since it might be phishing.
The Ministry of Digital Transformation, which backs the app, had taken it offline for maintenance. It said the app looked to have been compromised and asked people to switch on emergency notifications on their phones.
The Ukrainian Air Force's Telegram notice said the app had probably been hit by hostile interference and that no radiation threat existed. Ukraine's Central Intelligence Agency spoke of an app failure and advised checking other sources about air strike risks. It added that a radiation signal had also sounded on loudspeakers in the Lviv region, with no real hazard.
Russia reports an attack on its own app
Russia's ministry of emergency situations said its alert app suffered "a massive cyberattack" that pushed false information to the public. It gave no more details.
The Ukrainian outlet UNN reported fake warnings of a nuclear threat inside Russia. The partisan group Atesh, which operates in Russian-held territory, claimed the hack on Telegram with laughing emojis. The BBC has not verified a screenshot published by Atesh, which told users to stock up on provisions for three weeks. Atesh has been contacted for comment.
Our view
Nobody has said who is behind the Ukrainian incident: officials use the word "probably", and Atesh's claim is not verified. The messages stayed on phones for over an hour, which is long enough for some people to act on them. The Ministry of Digital Transformation could settle how the app was compromised, and whether the link in the message was part of a phishing attempt.
Source: BBC News